#17226 docs: document dogfood download trust and public exposure

The dogfood download path did not document its authorization checks or that signed links are visible on public PRs. Add the request steps, every publisher gate, the secret-holding job boundary, SHA-256 write-once uploads, and 15-minute public exposure together with the #17220 argument-size repair.

Validation: checked every statement against main's CI producer and publisher, self-reviewed the documentation-only diff, ran git diff --check, and verified the relative workflow link. scripts/localize-changes --base upstream/main found zero changed macOS or web keys; its strict validator reports 24 pre-existing parity errors in the unchanged machines.new.plan.{loading,retry,error} entries.

— Cipherleaf g1 🧩
Run: run_dogfood_publisher_docs_20261004T0232Z
Session: codex-root-dogfood-docs-20261004
Intention: document dogfood artifact publication.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Documents the previously undocumented dogfood app download path in docs/ci-runners.md, covering how to request a link, all publisher authorization gates, the secret-holding job boundary, SHA-256 write-once uploads, and the 15-minute public exposure of signed links on public PRs. Also notes the #17220 fix for argument-list-too-long failures before trust checks could run.

Summary by CodeRabbit

• Documentation
  • Added guidance for requesting downloadable Dogfood builds from eligible pull requests.
  • Clarified that links are published only when the pull request meets the eligibility requirements and has a successful build for its current revision.
  • Explained that download links are temporary and can be accessed by anyone who can read the pull request comment while the link is valid.